pytsk3 issues - Githubissues

christoftaylor commented 8 years ago

On a relatively fresh download of SIFT3, ran update-sift and it started generating errors. Everything from mantaray down failed to install. Any package I tried to apt-get after that failed to install. After some frustration and a lot of removing and installing of various packages, it appears the problem is mantaray tries to install pytsk3_4.2.0-20150406 which fails because there is also a pytsk3_4.2.0-20150325 available, then every attempt to install anything after that ends with apt-get telling me to run 'apt-get -f install'.

Errors look something like this: (trimmed to just the important lines)

...
Unpacking pytsk3 (4.2.0-20150406-1ppa1~trusty) ...
dpkg: error processing archive /var/cache/apt/archives/pytsk3_4.2.0-20150406-1ppa1~trusty_amd64.deb (--unpack):
 trying to overwrite '/usr/lib/python2.7/dist-packages/pytsk3.so', which is also in package python-pytsk3 20160325-1ppa1~trusty
...
Errors were encountered while processing:
 /var/cache/apt/archives/pytsk3_4.2.0-20150406-1ppa1~trusty_amd64.deb
E: Sub-process /usr/bin/dpkg returned an error code (1)

...

Would somebody mind verifying, is this just me. What do I need to do to get pytsk3 to play well with others?

ekristen commented 8 years ago

I just had my test vm run through the update process a few times and had no issues.

The VM is pretty old, I'll have to test using the VM.

sygmus commented 8 years ago

I downloaded SIFT ova today. Most packages updated with update-sift. Exceptions:

mantaray failed (100) - went to mantaray website (http://mantarayforensics.com/) and it appears that there are issues there - get a splash screen telling the owner of the site to contact tech support - so either broken, out of business, non-payment, or other misfortune has apparently befallen the mantaray forensics team.
docker-engine failed (100) - installed manually as per here: https://docs.docker.com/engine/installation/ passed "hello world test", but not the bash test - so maybe OK???
elasticsearch failed (100) - installed manually as per: https://github.com/sans-dfir/sift/issues/51 NOTE added comment by me at bottom - json example has been moved
plaso failed - installed by elasticsearch script noted above. Maybe OK?? :::hope this helps!

sygmus commented 8 years ago

oops - #51 above should be: https://github.com/sans-dfir/sift/issues/51

sygmus commented 8 years ago

...editor is making me mad.... #51 should be: https: //github.com/sans-dfir/sift/issues / 51 (remove the spaces in URL...)

christoftaylor commented 8 years ago

mantaray was a ManTech product. Not sure if they actively maintain it. Unfortunately, all my contacts within that team have moved on, so I’m not sure who to notify.

I’m sorry I didn’t provide this feedback earlier, I totally just spaced and forgot this was still sitting open.

I was seeing mantaray and a some others (but I don’t remember if it was this exact list) fail because pytsk3 was failing and was a dependency. Once I fixed pytsk3, they installed ok.

pytsk3 was failing because apt-get was to install two different versions of pytsk3. It would basically fail with a note about files already existing, even though didn’t already exist prior to trying to install. To get around that, I downloaded the package for the most recent version and installed with a --force option so it would overwrite the file it was complaining about.

Hope that helps. Thanks!

On Jun 28, 2016, at 15:45, sygmus notifications@github.com wrote:

I downloaded SIFT ova today. Most packages updated with update-sift. Exceptions:

mantaray failed (100) - went to mantaray website (http://mantarayforensics.com/ http://mantarayforensics.com/) and it appears that there are issues there - get a splash screen telling the owner of the site to contact tech support - so either broken, out of business, non-payment, or other misfortune has apparently befallen the mantaray forensics team. docker-engine failed (100) - installed manually as per here: https://docs.docker.com/engine/installation/ https://docs.docker.com/engine/installation/ passed "hello world test", but not the bash test - so maybe OK??? elasticsearch failed (100) - installed manually as per: #51 https://github.com/sans-dfir/sift/issues/51 NOTE added comment by me at bottom - json example has been moved plaso failed - installed by elasticsearch script noted above. Maybe OK?? :::hope this helps! — You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/sans-dfir/sift/issues/110#issuecomment-229206934, or mute the thread https://github.com/notifications/unsubscribe/ASzMOqJhvGgoYCPvlojH9gKyjHkwv2hnks5qQaQOgaJpZM4Isu58.